Malicious code in rainbowcolors (PyPI)

Source: amazon-inspector c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd The package advertises itself as an ANSI-color helper but on Windows the first call to any Color method print/paint/call downloads an opaque executable solace.exe from an anonymous gofile.io file-share URL...

CVE-2026-123508

Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries...

Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion

A directory traversal vulnerability in the Preventive & Reservation compreventive component 1.0.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1475 info: name: Joomla...

EUVD-2026-119393

Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries...

PT-2026-139789

Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries...

CVE-2026-123508: go-vikunja vikunja: Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and…

Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries...

GuardModel

GuardModel Block malicious AI models in your pipeline with one line of YAML. GuardModel is a GitHub Action that automatically scans ML model files for malicious code, vulnerabilities, and security risks in CI/CD pipelines. It blocks dangerous models before they reach production by detecting pickl...

Malicious code in qzc690384 (PyPI)

Source: kam193 dbd73fb476a20a6d0f4bc4fe820a007283789e6c03548f93e67fff7a58b2ede1 In this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remo...

MAL-2026-18752 Malicious code in qzc690384 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aaf64364e0f3a5688772d501b9400cd9caf65ecdc82a869844ff73999aff2e4 The adjudication model's output was cut off by the provider safety filter on every attempt, which happens when the reviewed code reads like operation...

Malicious code in qzc690384 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aaf64364e0f3a5688772d501b9400cd9caf65ecdc82a869844ff73999aff2e4 The adjudication model's output was cut off by the provider safety filter on every attempt, which happens when the reviewed code reads like operation...

Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit

Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit CVE-2021-40444 EXPLOIT TO USE IN METASPLOIT, ALLOWS ATTACKERS TO GET AN REMOTE CODE EXECUTION THROUGH MICROSOFT OFFICE WORD BY INJECTING MALICIOUS CODE IN THE FILE...

web_exploit_detector

Web Exploit Detector Introduction The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites. Running the...

MAL-2026-18749 Malicious code in qzc690382 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e The package body is inert init.py contains only c\n; the entire functionality lives in setup.py, which runs on pip install. During install, setup.py...

php-malware-finder

PHP Malware Finder | || || || | | | | || || | | || || || | Webshell finder, | || || | kiddies hunter, | | | |||| || | website cleaner. || || |||| Detect potentially malicious PHP files. What does it detect? PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files usi...

Malicious code in reqnest (PyPI)

Source: kam193 819e0998a4223acf5f70c15fbbeea8f9c9bf801044d5974622ebc2a971bc2c61 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-reqnest Reasons based on the...

Malicious code in ajfhiuqhfqgwerhuqnfqh (PyPI)

Source: kam193 e1da9c2dae077cc96d13ab9964ca2887742f0dc1bc2a3e92f4b0bf9b6d0e3b04 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-reqnest Reasons based on the...

Malicious code in fhqiouhq (PyPI)

Source: kam193 50625c43075a763e4420504dcbcc8b14236874f2924ec20eabcf5d7b45b0a274 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-reqnest Reasons based on the...

Malicious code in @nuri.yavuz.tr.2/my-unique-pinger (npm)

Source: ossf-package-analysis d9a584d7d9890fd25a656e38f323071b7ac3b419a2050fe50452c598f78a4876 The OpenSSF Package Analysis project identified '@nuri.yavuz.tr.2/my-unique-pinger' @ 1.0.2 npm as malicious. It is considered malicious because: - The package executes one or more commands associated...

Malicious code in kurobails (npm)

kurobails is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own authenticated WhatsApp account to an author-chosen WhatsApp Channel. Part of the campaign OX Security documented as "PhantomSub" 2026-09-28:...

Malicious code in oktz-baileys (npm)

oktz-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own authenticated WhatsApp account to an author-chosen WhatsApp Channel. Part of the campaign OX Security documented as "PhantomSub" 2026-09-28:...